fix(docker): B5 tighten bash-guard denial message to 2 lines

Smoke run 3 showed the bash-guard hook emitting 8+ lines on every
blocked shell-git op — enumerating every alternative MCP verb across
roboco-flow / roboco-do / roboco-git-readonly. That's repeated token
spend on every refused retry; the LLM doesn't need the full alt-list
inline, it has the role prompt + the MCP tool schema for that.

Trimmed to 2 lines: denial reason + a one-line pointer to the role's
State→Verb table. Test asserts <= 3 echo lines in any denial block.

Spec ref: docs/superpowers/specs/2026-05-12-post-smoke-3-fixes-design.md
section B5.

docker/scripts/bash-guard-hook.sh

@@ -38,33 +38,8 @@ low=$(printf '%s' "$cmd" | tr "[:upper:]" "[:lower:]")
 
 # --- git network / auth ops ---------------------------------------------------
 if echo "$low" | grep -qE '(^|[[:space:];&|])git[[:space:]]+(fetch|pull|push|clone|remote|ls-remote|checkout|commit|merge|rebase|reset|cherry-pick|revert|tag[[:space:]]+-d|update-ref|reflog[[:space:]]+delete)'; then
-    cat <<'EOF' >&2
+    echo "Denied: shell git for network / auth / branch-mutating ops is blocked." >&2
-Denied: shell git for network / auth / branch-mutating ops is blocked.
+    echo "Use the verb listed in your role's State→Verb table (e.g. commit, complete, i_am_done)." >&2
-
-Read-only inspection (any role):
-  - roboco-git-readonly MCP: roboco_git_status / _log / _diff / _branch_list
-
-Write paths — there is NO direct shell-git or "roboco_git_commit" tool.
-Use the verb that matches your role; the choreographer handles git for you:
-
-  - developer / documenter: roboco-do `commit(message, files)`
-      → auto-prefixes [task-id], pushes to your branch, opens a PR via
-        the choreographer when the task transitions out of in_progress.
-        Your branch is auto-created when you call i_will_work_on().
-
-  - cell_pm / main_pm: roboco-flow `complete(task_id, notes)`
-      → cell_pm merges the leaf PR; main_pm opens the master PR and
-        escalates to CEO. PMs never run git directly — they delegate
-        code work to devs and complete to merge.
-
-  - any role: branches are NOT something you set up. They are created
-    on claim/i_will_work_on. If you don't see your branch, check that
-    you're actually claimed on the task.
-
-Raw `git fetch` etc. don't have auth (the PAT is injected only inside
-the MCP layer) and will fail with "could not read Username for
-'https://github.com'".
-EOF
     exit 2
 fi
 

tests/integration/test_bash_guard_message.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Smoke: bash-guard denial message is <= 3 lines (was 8+).
+# Smoke run 3 (2026-05-12) showed agents getting an 8-line refusal on
+# every blocked shell-git op. Tighter messages save tokens on retries.
+set -e
+
+cd "$(dirname "$0")/../.."
+
+HOOK=docker/scripts/bash-guard-hook.sh
+
+# Count lines in the longest heredoc denial block (cat <<'EOF' ... EOF style).
+# The first git-network denial used a heredoc; awk counts echo-or-content
+# lines inside it.
+HEREDOC_LINES=$(awk '
+  /cat <<'"'"'EOF'"'"'/ { in_block = 1; count = 0; next }
+  in_block && /^EOF$/ { print count; in_block = 0; count = 0; next }
+  in_block { count++ }
+  END { if (in_block && count > 0) print count }
+' "$HOOK" | sort -n | tail -1)
+
+# Also count contiguous echo-based denial blocks (other denial paths).
+ECHO_LINES=$(awk '
+  /Denied/ { in_block = 1; count = 0 }
+  in_block && /^[[:space:]]*echo/ { count++ }
+  in_block && /^[[:space:]]*$/ && count > 0 { print count; in_block = 0; count = 0 }
+  END { if (in_block && count > 0) print count }
+' "$HOOK" | sort -n | tail -1)
+
+MAX_LINES=0
+[[ -n "$HEREDOC_LINES" && "$HEREDOC_LINES" -gt "$MAX_LINES" ]] && MAX_LINES=$HEREDOC_LINES
+[[ -n "$ECHO_LINES" && "$ECHO_LINES" -gt "$MAX_LINES" ]] && MAX_LINES=$ECHO_LINES
+
+if [ "$MAX_LINES" -eq 0 ]; then
+    echo "FAIL: could not find any denial message block in $HOOK"
+    exit 1
+fi
+
+if [ "$MAX_LINES" -gt 3 ]; then
+    echo "FAIL: bash-guard denial message has $MAX_LINES lines (max 3)"
+    exit 1
+fi
+
+echo "PASS: denial message has $MAX_LINES lines"